Kali 2.0 was released last week which means that we get to spend some time sifting through Offensive Security's latest release looking at all the new tools and tricks. Offensive Security promised us a better, more powerful penetration testing platform, and my preliminary look at 2.0 shows that they delivered. The Look Kali 2.0 switched over to the GNOME3 interface which ... READ MORE
Blog
Retrieving Credentials from Configuration Files
“Security is not convenient.” Though blunt, this phrase neatly captures the fundamental conflict between typical users and information security personnel. Typical users want their workstations and networks to be configured for speed, accessibility, and convenience, whereas security professionals prioritize tight access control and monitoring. If you believe that security is ... READ MORE
Sophos UTM Home Edition 5 – SSL VPN
The topic of today's post is setting up an SSL VPN through the Sophos UTM Home Edition. The ease-of-use VPN solution was one of my primary reasons for pursuing this particular UTM in the first place, and so I think it's a topic definitely worth exploring. There are a variety of VPN options within the UTM. I'll only be covering the SSL option here. If you are looking to set up a ... READ MORE
Injecting Python Code Into Native Processes
There is quite a bit of material publicly available on DLL injection, the different techniques and how it works. Often times it's helpful for a researcher to be able to execute code within the context of a specific process, and DLL injection is an ideal way to accomplish this. By injecting a DLL into another process, that process can be "infected" allowing the injected DLL to ... READ MORE
Sophos UTM Home Edition 4 – Definitions and Rules
UPDATE: Part 5 - SSL VPN is now available. In the first and second posts in this series, we stepped through the installation of the Sophos UTM. Two weeks ago, we finished up the setup process. Now, we're going to start exploring the meat and potatoes of Sophos' free UTM solution. This week, I'm going to cover establishing definitions and ... READ MORE
Metasploit Module of the Month – web_delivery
In the second edition of this series we are going to take a look at an exploit module that doesn't get a lot of attention. I'll use "exploit" in the same context that Metasploit does, which means that upon successful completion of this module you get a shell. It doesn't mean that this module is some super 1337 browser exploit/sandbox escape 0day, which I think, is partly ... READ MORE
King Phisher 0.2.1 Released
Yesterday, RSM released the latest version of their King Phisher phishing campaign toolkit. This version adds some exciting new features with a focus on usability. The message editor received some nice improvements, including syntax highlighting. The editor window now uses the GtkSourceView project to provide a more user friendly environment for writing and modifying ... READ MORE
How to Bypass SEP with Admin Access
I realize that this post is an edge case, but I recently used this method to bypass SEP (Symantec Endpoint Protection) during a pen test, so for my reference and that one person who runs into a similar scenario I am writing this. A little bit of backstory: I was able to acquire a shared local administrator's credentials during a pen test. I was using them to gain access to ... READ MORE
Sophos UTM Home Edition – 3 – The Setup
UPDATE: Part 4 – Definitions and Rules and Part 5 - SSL VPN are now available. It's been quite a while since I wrote the initial two Sophos UTM posts. I recently upgraded from a really old, re-purposed HP box to a slightly-less-old Dell Precision 670 courtesy of steiner, and I took the opportunity to document the setup process. This post assumes you have followed the ... READ MORE
Decrypting SSL Traffic with Wireshark
I recently was involved in an responding to an incident and one thing that was key to our investigation was decrypting SSL traffic. The attacker got a web shell on one of the servers and was mucking around with that. All of the traffic was over HTTPS, but we fortunately had the key. This allowed us to decrypt the traffic and view all of the commands issued. It was quite ... READ MORE